Feat/natural language goal creation by cyb3ralee · Pull Request #1016 · Suncrest-Labs/nester

cyb3ralee · 2026-07-31T14:01:08Z

Summary

Adds natural-language goal creation using Claude structured output. Users can create savings goals by describing them in plain language.

Changes

Added goal_extractor.py service with Claude structured output
Added natural_language_goal.py router for API endpoints
Extracts: name, amount, deadline, category from natural language
Validates deterministically after extraction
Surfaces ambiguities for confirmation (never guesses)
Prompt injection resistant
Added comprehensive tests

API Endpoints

POST /intelligence/extract-goal - Extract structured goal from natural language
POST /intelligence/confirm-goal - Confirm and create the extracted goal

Security

Prompt injection protection via pattern matching
Input validation before any LLM call
No data leaks in error messages
Model ID pulled from config (not hardcoded)

Closes #853

Bump ethnum 1.5.0 -> 1.5.3 in packages/contracts so the contract crate compiles on the current stable toolchain (rustc 1.97.1). ethnum 1.5.0 fails with error[E0512] transmuting () into TryFromIntError, which no longer share a size; the crate fixed it in 1.5.1. Bump apps/api to Go 1.25.12 and golang.org/x/text v0.39.0 to clear the two govulncheck findings not in the allowlist: GO-2026-5856 (crypto/tls, fixed in go1.25.12) and GO-2026-5970 (x/text, fixed in v0.39.0).

… for chat/analyze (Suncrest-Labs#875) * feat(intelligence): add prompt-injection and output-safety guardrails Claude calls in the chat and analyze paths had no defense against prompt injection or system-prompt extraction, and recommendation output wasn't schema-enforced. Add input screening (regex-based, logs request_id + a non-reversible fingerprint, never raw content), a hardened system prompt with an explicit trust boundary and tagged untrusted-content wrapping, deterministic history/message bounding, and output post-processing that strips leaked system-prompt text and enforces a non-model-controlled disclaimer on /analyze and related endpoints. * fix(intelligence): close remaining guardrail gaps from review - Validate inbound X-Request-Id against a bounded safe charset before trusting it in state/headers/logs, falling back to a fresh UUID otherwise (prevents log/header injection via a client-supplied header). - Fix the chat streaming leak-redaction buffer to retain a sanitized lookback tail on flush instead of resetting to empty, so a system-prompt marker split across two deltas is still caught. - Wrap the remaining unwrapped context data interpolated into the recommend/vault and analyze prompts (positions, vault/user context lines) in the same trust-boundary tags used elsewhere. - Sanitize the few model-derived output fields that were missed: confidence_reason/data_freshness in Recommendation, insight card action.label/href, and deposit schedule note.

…ured output - Add goal_extractor service with Claude structured output - Add natural_language_goal router for API endpoints - Extract name, amount, deadline, category from natural language - Validate deterministically after extraction - Surfaces ambiguities for confirmation, never guess - Prompt injection resistant - Add comprehensive tests Closes Suncrest-Labs#853

netlify · 2026-07-31T14:01:14Z

✅ Deploy Preview for nesterhq canceled.

Name	Link
🔨 Latest commit	`fe1f2df`
🔍 Latest deploy log	https://app.netlify.com/projects/nesterhq/deploys/6a6cab3d36caa40008d829e8

netlify · 2026-07-31T14:01:30Z

✅ Deploy Preview for nesterdapp ready!

Name	Link
🔨 Latest commit	`fe1f2df`
🔍 Latest deploy log	https://app.netlify.com/projects/nesterdapp/deploys/6a6cab3d36caa40008d829ea
😎 Deploy Preview	https://deploy-preview-1016--nesterdapp.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

coderabbitai · 2026-07-31T14:02:07Z

Warning

Review limit reached

@smartalee, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 35 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 65361226-8911-4a7c-95df-5261545e9169

📥 Commits

Reviewing files that changed from the base of the PR and between a9648ae and fe1f2df.

⛔ Files ignored due to path filters (2)

apps/api/go.sum is excluded by !**/*.sum
packages/contracts/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (21)

AUDIT_REPORT.md
AUDIT_THREAT_MODEL.md
CI_CD_VALIDATION_REPORT.md
SEP24_DECISION.md
apps/api/go.mod
apps/intelligence/app/main.py
apps/intelligence/app/models/coaching.py
apps/intelligence/app/models/recommendation.py
apps/intelligence/app/routers/analyze.py
apps/intelligence/app/routers/chat.py
apps/intelligence/app/routers/coaching.py
apps/intelligence/app/routers/natural_language_goal.py
apps/intelligence/app/routers/ws_chat.py
apps/intelligence/app/services/goal_extractor.py
apps/intelligence/app/services/guardrails.py
apps/intelligence/app/services/prometheus.py
apps/intelligence/tests/test_goal_extractor.py
apps/intelligence/tests/test_guardrails.py
packages/contracts/contracts/goal_rewards/Cargo.toml
packages/contracts/contracts/goal_rewards/src/lib.rs
packages/contracts/contracts/goal_rewards/src/test.rs

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

Resolve merge conflict in branch feat/natural-language-goal-creation

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

cyb3ralee · 2026-09-08T13:12:15Z

Hey any updates?

0xDeon and others added 4 commits July 22, 2026 22:28

chore: remove internal audit and decision report files from repo root

64e6e1b

cyb3ralee requested a review from 0xDeon as a code owner July 31, 2026 14:01

Merge dev and resolve conflicts

fe1f2df

0xDeon closed this Sep 23, 2026

Navigation Menu

Feat/natural language goal creation - #1016

Feat/natural language goal creation#1016
cyb3ralee wants to merge 5 commits into
Suncrest-Labs:devfrom
cyb3ralee:feat/natural-language-goal-creation

cyb3ralee commented Jul 31, 2026

Uh oh!

netlify Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jul 31, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading

Review limit reached

Uh oh!

cyb3ralee commented Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

cyb3ralee commented Jul 31, 2026

Summary

Changes

API Endpoints

Security

Uh oh!

netlify Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for nesterhq canceled.

Uh oh!

netlify Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for nesterdapp ready!

Uh oh!

coderabbitai Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

cyb3ralee commented Sep 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify Bot commented Jul 31, 2026 •

edited

Loading

netlify Bot commented Jul 31, 2026 •

edited

Loading

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading